find-relevant-case

Search for existing cases related to specific indicators or entities. Use to find correlation with other investigations before starting new analysis. Takes search terms and returns matching case IDs.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/find-relevant-case/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, mostly executable single-purpose skill with a clear workflow and a verification step. Its main gaps are the unresolved `constructed_filter` placeholder, an optional rather than mandatory verification step, and minor repetition across sections.

Suggestions

Replace the `constructed_filter` placeholder with a concrete filter construction example (or reference the list_cases filter schema) so Step 1 is copy-paste ready.

Make the Step 4 verification/refinement step a required checkpoint with an explicit feedback loop (verify entity presence; if a candidate lacks the entity, drop it and continue) rather than marking it optional.

De-duplicate the list_cases search-limitation note: state it once in Limitations & Workarounds and reference it from Step 1 instead of repeating the caveat.

Dimension	Reasoning	Score
Conciseness	The body is lean with terse steps and code snippets and assumes Claude's competence, but the list_cases search-limitation caveat is stated in both Step 1 and Limitations, a minor instance of over-explanation that keeps it at 4 rather than 5.	4 / 5
Actionability	Concrete tool calls are provided (secops-soar.list_cases(...), get_case_full_details(...)), but `constructed_filter` is an unresolved placeholder and Step 1 underspecifies how to build the filter, so guidance is mostly executable with minor gaps (anchor 4) rather than copy-paste ready (5).	4 / 5
Workflow Clarity	A clear numbered 4-step sequence includes a verification/refine step (Step 4: verify entity presence via get_case_full_details), but that step is optional and lacks an explicit verify-fix-retry feedback loop, fitting anchor 4 rather than 5; the read-only nature of the search limits the destructive/batch cap.	4 / 5
Progressive Disclosure	Content is well-organized into clean sections (Inputs, Workflow, Outputs, Limitations) with no bundle files needed and no inlined bulk, but at ~55 lines it slightly exceeds the simple-skill threshold and repeats a caveat, keeping it at 4 rather than 5.	4 / 5
	Total	16 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and when to use it with concrete domain-specific actions and an explicit trigger clause. It is held back from the top band by a non-comprehensive action list, missing common synonyms (IOC/incident), and a when-clause that lacks concrete user-sayable trigger phrases.

Suggestions

Expand the action list for specificity: e.g., 'Search for existing cases by IOCs, hostnames, or usernames; returns matching case IDs with priority and status.'

Add concrete user-sayable trigger phrases to the when-clause, e.g., 'Use when the user mentions IOCs, prior incidents, or wants to correlate the current investigation with existing cases.'

Include common synonyms/extensions such as IOC, incident, and correlate to broaden natural trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Names the domain (cases/indicators/entities) and two concrete actions ('Search for existing cases', 'Takes search terms and returns matching case IDs'), matching anchor 3 rather than 4 because the action list is not comprehensive.	3 / 5
Completeness	Both the 'what' (search existing cases, return matching case IDs) and an explicit 'when' ('Use to find correlation with other investigations before starting new analysis') are present, but the when-clause lacks concrete user-sayable trigger phrases, so it sits at 4 rather than 5.	4 / 5
Trigger Term Quality	Includes natural analyst-facing keywords ('existing cases', 'indicators', 'entities', 'investigations', 'case IDs') but misses common synonyms like IOC/incident/correlate, fitting anchor 4 rather than the comprehensive coverage of 5.	4 / 5
Distinctiveness Conflict Risk	The niche of finding existing SOAR cases for correlation is mostly distinct, with only minor overlap risk against sibling search/enrichment skills, fitting anchor 4 rather than the fully conflict-free niche of 5.	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: dandye/ai-runbooks
Path: skills/find-relevant-case/SKILL.md
Commit: 72a6863

Reviewed: 6 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.